Apache error log: where it is, how to read it and common entries

Published Sources checked By helps.wiki editorial team

The Apache error log is the first place to look when httpd won't start or returns 403, 404 or 500 with no obvious reason. Find its path with the `ErrorLog` directive, watch it with `tail -f` while you reproduce the problem, and search by the `AHnnnnn` code in each entry. If the log looks empty, the usual reasons are a `LogLevel` that hides the message, a per-virtual-host log, or a log that was not reopened after rotation.

Applies to:Apache HTTP Server2.4 (Linux, Windows, macOS)
On this page

What it means

The error log is Apache httpd's diagnostic log. It records startup failures, request errors, messages from modules and anything CGI scripts write to stderr. Its location is set by the ErrorLog directive, and the Apache documentation says to check it first when the server will not start or behaves oddly.

By default the file is logs/error_log on Unix and logs/error.log on Windows. A relative path is taken from ServerRoot. Linux distributions often move it: Debian and Ubuntu typically use /var/log/apache2/error.log, and RHEL, CentOS and Fedora typically use /var/log/httpd/error_log. Your server's ErrorLog setting is the final word, so confirm the real path as shown below.

A typical entry looks like this (the example from the Apache docs):

[Fri Sep 09 10:42:29.902022 2011] [core:error] [pid 35708:tid 4328636416] [client 72.15.99.187] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error

Read left to right: timestamp, [module:severity], [pid:tid], the client IP, then an AHnnnnn message code and the text. The AH code is the best thing to search for. This article covers Apache 2.4 only. For a 500 response specifically, see Apache 500 Internal Server Error.

Symptoms and causes

You are likely dealing with this problem if:

  • Apache fails to start or reload, and the console says little.
  • Pages return 403, 404 or 500 and you can't see why.
  • On Windows, the Services applet only shows "Error 1067; The process terminated unexpectedly".
  • The error log is empty, or lacks the entries you expect.

The usual causes, most common first:

LogLevel hides the message
The default LogLevel is warn. In 2.4 some messages were moved from error to info, for example "File does not exist" for 404s, so they no longer appear at the default level.
You are reading the wrong file
Each <VirtualHost> can set its own ErrorLog, and ErrorLog can also point to syslog or a piped program. On Windows, very early startup errors go to the Application log in Event Viewer because error.log is not usable yet.
The log was not reopened after rotation
httpd keeps writing to the old file handle until it receives a signal. A logrotate setup without a graceful reload leaves the new file empty.

How to fix it

Work through these in order. They start with the quickest, safest checks and move to deeper repairs; stop as soon as the problem is gone.

1.Find the log and watch it live

Easy

Most problems show up as a fresh line the moment you reproduce them.

  1. Find the ErrorLog setting by searching the config. The folders below are the usual ones on Debian/Ubuntu and RHEL-family systems; adjust if yours differ.
    Terminalneeds sudo / root
    grep -ri ErrorLog /etc/apache2 /etc/httpd
  2. Follow the file while you reload the page or restart the service. Replace the path with the one you found.
    Terminalneeds sudo / root
    tail -f /var/log/apache2/error.log
  3. Check the configuration syntax before restarting. apachectl is the control front end to httpd and its configtest option runs the syntax check.
    Terminalneeds sudo / root
    apachectl configtest
  4. Copy the AHnnnnn code from the entry and search for it. The FAQ below explains the entries people hit most often.

2.Raise verbosity temporarily

EasyChanges settings

If the entry you expect never appears, LogLevel is probably filtering it out.

Before you start: Back up the config file first. Debug levels make the log grow very fast, so revert the change when you are done.

  1. Add or change LogLevel in the main config or the relevant virtual host.
    Apache config
    LogLevel info
  2. To restore the 2.2 behaviour for 404 "File does not exist" messages, use this instead.
    Apache config
    LogLevel warn core:info
  3. To debug one module only, such as mod_rewrite (the docs recommend this for mod_rewrite and mod_proxy), raise just that module.
    Apache config
    LogLevel info rewrite:trace5
  4. Reload Apache, reproduce the problem, read the log, then set LogLevel back.

3.Diagnose a Windows service that won't start

Moderate

The Services applet only shows "Error 1067", but running httpd from a console writes the real reason to the log.

  1. Open a Command Prompt and run httpd from its folder (adjust the path if you installed elsewhere), then read the log.
    Command Promptrun as administrator
    cd "\Program Files\Apache Software Foundation\Apache2.4\bin"
httpd.exe
cd ..\logs
more < error.log
  2. Also open Event Viewer, then Windows Logs, then Application, and look for Apache entries from startup.
  3. If the service reports error 2186, the account set under Log On As for the service usually cannot reach a required network resource. Check that account's access.

4.Set up log rotation that doesn't leave an empty log

ModerateChanges settings

Rotation that doesn't make httpd reopen the file leaves the new log empty while the old one keeps growing.

Before you start: Back up your existing config. Test the syntax and reload during a quiet period.

  1. Recommended by the docs: pipe the log through rotatelogs, which needs no restart. The number is seconds between rotations; use a size such as 100M instead to rotate by size.
    Apache config
    ErrorLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/error_log 86400"
  2. Alternative: keep logrotate, but make its postrotate step run apachectl graceful or systemctl reload (service name depends on the distro) so httpd reopens the file.

5.Change the log destination or format

ModerateChanges settings

Useful when you need syslog, or want a request ID shared with the access log.

Before you start: Back up the config first and run a syntax test before reloading.

  1. Send the log to syslog with an optional facility and tag.
    Apache config
    ErrorLog syslog:user:httpd.srv1
  2. Or define your own line format.
    Apache config
    ErrorLogFormat "[%t] [%l] [pid %P] %F: %E: [client %a] %M"
  3. To match error and access log lines for the same request, put %L in both LogFormat and ErrorLogFormat. If mod_unique_id is loaded, its request ID is used.

Check that it worked

  • A fresh entry appears in the error log (check with tail -f) when you reproduce the problem.
  • After rotation, the new log file receives lines and the old one stops growing.
  • Any LogLevel change you made for debugging has been reverted.

If it still fails

  • Run apachectl -S to print the parsed virtual host settings and confirm which virtual host and log file actually handle the request.
  • On Windows, check Event Viewer, Application log, for errors that never reached error.log.
  • Search the exact AHnnnnn code in the official Apache HTTP Server 2.4 documentation.

Questions

What do the AH codes mean?

Each AHnnnnn code identifies one specific message in Apache. Searching for the code together with the message text is more reliable than searching for the text alone.

What does AH01797 "client denied by server configuration" mean?

An access rule blocks the request. After upgrading from 2.2 to 2.4, old Order/Allow/Deny rules mixed with Require can override each other. Use Require all granted or Require ip ... consistently, and don't mix old and new directives in one merge chain. The Apache upgrading guide shows this entry.

What does AH00558 "could not reliably determine the server's fully qualified domain name" mean?

It is a warning: there is no global ServerName, so Apache guessed. Add ServerName example.com (or localhost) to the main config, then reload. See the ServerName directive.

What does AH00072 "make_sock: could not bind to address" mean?

Another process, or a second Apache instance, already uses the port that Listen asks for (often 80 or 443). Find the owner with ss -tulpn | grep :80, then stop that process or change Listen. See the Listen directive.

What does "Invalid command 'Order'" or "Invalid command 'Require'" mean?

The config syntax and the loaded modules don't match. Load mod_access_compat to keep the old Order syntax, or migrate the config to 2.4 Require syntax.

Sources

  1. Log Files (Apache HTTP Server 2.4)Official · Apache Software Foundation
  2. Apache Core Features (ErrorLog, ErrorLogFormat, ServerName)Official · Apache Software Foundation
  3. Apache MPM Common Directives (Listen)Official · Apache Software Foundation
  4. Server and Supporting Programs (apachectl)Official · Apache Software Foundation
  5. Using Apache HTTP Server on Microsoft WindowsOfficial · Apache Software Foundation
  6. Upgrading to 2.4 from 2.2Official · Apache Software Foundation

Browse